Microsoft Windows 2000 Server and Windows Server 2…….ppt

Microsoft Windows 2000 Server and Windows Server 2003: Password and Account Lockout FeaturesMike Resnick and Joe VasilDirectory Services SupportMicrosoft Corporation Agenda Understand the security threats being faced and the costs Password and account lockout policy settings Security, password, and account lockout recommendations Authentication behavior New features in Service Pack 4 and Microsoft? Windows? Server 2003 Procedures to troubleshoot account lockout events Tools to use Passwords Are the Keys to the Kingdom: Threats Dictionary attacks Brute force attacks Users’ lack of secure practices Administrators’ lack of secure practices Passwords Are the Keys to the Kingdom: Risk Assessment Password length and possible permutations 6 characters = 689,869,781,056 7 characters = 64,847,759,419,264 8 characters = 6,095,689,385,410,816 9 characters = 572,994,802,228,616,704 10 characters = 53,861,511,409,489,970,176 Given a 60 day password expiry date and a password of 7 characters, it would require about 7,407,407 logon attempts per second to find the password Play the lottery, the odds are much better Password Settings: Password Filter Used to enforce password complexity in the domain Password filtering is built into Windows 2000 Server and Windows Server 2003 By default it is disabled, but can be enabled through GPO Microsoft Windows NT? 4.0 required Passfilt.dll and a registry change 161990, “How to Enable Strong Password Functionality in Windows NT” Password Settings: Other Password Settings Password history Minimum length Maximum password age Minimum password age Account Lockout Settings: LockoutThreshold Account lockout threshold (lockoutthreshold) Account Lockout Settings: Other Account Settings Reset account lockout counter after (ObservationWindow) Account lockout duration (Lockoutduration) Correct Setting for Invalid Logon Attempts The goal is to balance the need to prevent account cracking versus the need to allow room for users mistyping pa